Distrust Virus

 Virus Name:  Distrust 
 V Status:    Rare 
 Discovered:  April, 1994 
 Symptoms:    .COM & .EXE growth; TSR; 
              Available free memory decreases in 64K blocks 
 Origin:      Unknown 
 Eff Length:  1,588 - 1,604 Bytes 
 Type Code:   PRsA - Parasitic Resident .COM & .EXE Infector 
 Detection Method:  ViruScan, F-Prot, Sweep, AVTK, IBMAV, NAV, 
                    NAVDX, VAlert, PCScan, ChAV, 
                    NProt, AVTK/N, NShld, Sweep/N, IBMAV/N, NAV/N 
 Removal Instructions:  Delete infected files 
 General Comments: 
       The Distrust virus was submitted in April, 1994, its origin or point 
       of isolation is unknown.  Distrust is a memory resident infector of 
       .COM and .EXE files, but not COMMAND.COM. 
       When the first Distrust infected program is executed, this virus 
       will install itself memory resident as a low system memory TSR of 
       3,424 bytes, hooking interupts 08, 21, and 24.  Once memory resident, 
       the virus will occassionally allocate an additional block of 64K, 
       so available system memory will actually decrease by more than 3,424 
       Once the Distrust virus is memory resident, it will infect .COM and 
       .EXE programs, when they are executed.  Infected .COM programs will 
       increase in size by 1,588 bytes with the virus being located at the 
       beginning of the file.  In the case of .EXE programs, the file will 
       increase in size by 1,594 to 1,604 bytes with the virus being located 
       at the end of the file.  In both cases, the file's date and time in 
       the DOS disk directory listing will not be altered.  No text strings 
       are visible within the viral code. 

Show viruses from discovered during that infect .

Main Page